AD CS ESC1 and ESC8 Attacks: Microsoft Findings

Introduction

Microsoft has published new threat research showing how a simple help desk impersonation scam can escalate into full certificate-based compromise in Active Directory environments. For security teams, the key lesson is that user-approved remote access combined with weak Active Directory Certificate Services (AD CS) settings can quickly lead to privileged persistence.

What’s new

Microsoft analyzed two human-operated intrusion paths that started the same way:

• Attackers used Microsoft Teams messages and calls to impersonate IT or help desk staff.
• Users were convinced to launch Quick Assist and approve a remote session.
• Threat actors staged portable runtimes such as Python, Bun, or Java from user-writable folders.
• They then performed host discovery, network discovery, and AD CS assessment.

From there, the attacks diverged:

ESC1 certificate template abuse

In the first case, the attacker found an ESC1-vulnerable certificate template. This allowed a low-privileged account to request an authentication certificate for a privileged identity, which was then used to perform DCSync.

ESC8 NTLM relay to AD CS Web Enrollment

In the second case, the attacker used PetitPotam to coerce authentication from a Windows server, relayed the domain controller’s NTLM authentication to AD CS Web Enrollment, and obtained a certificate for the domain controller account. That certificate was then used for PKINIT-based Kerberos authentication.

Why it matters for IT admins

These attacks did not exploit a Microsoft Teams vulnerability. Instead, they relied on:

• Social engineering
• Overly permissive or insecure AD CS configurations
• Incomplete containment during incident response

Microsoft also noted that certificates can outlive the initial compromise. Resetting a password or reimaging a workstation does not automatically revoke issued certificates or already-issued Kerberos tickets.

A major response lesson came from the first case: a privileged identity excluded from automated containment remained usable and later enabled data exfiltration. In the second case, faster isolation of the affected workstation helped stop further attacker progress.

Recommended next steps

Security and identity teams should review:

• AD CS certificate templates for ESC1-style misconfigurations
• AD CS Web Enrollment exposure and NTLM relay protections related to ESC8
• Quick Assist and remote support controls
• Microsoft Defender automated disruption exclusions to ensure privileged accounts are covered
• Hunting and alerting for portable runtimes launched from user-writable staging directories after remote sessions

Organizations using AD CS should treat certificate abuse as a priority detection and hardening area, especially where remote support workflows are common.